CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- tenda ac6 firmwareTenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function.6.5 Medium
- antabot white-jotterAn issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a...7.6 High
- No product listedGFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName...4.2 Medium
- No product listedAn XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for...5.5 Medium
- pbootcmsSQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in...5.1 Medium
- oxyno-zeta s3-proxyReflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy8.4 High
namada-appscrates.ioNamada-apps allows Excessive Computation in Mempool Validation9.2 Criticalnamada-appscrates.ioNamada-apps can Crash with Excessive Computation in Mempool Validation9.2 Criticalnamada-appscrates.ioNamada-apps allows Post-Genesis Validator BypassNo scoregithub.com/cosmos/cosmos-sdkGoCosmos SDK: Groups module can halt chain when handling a malicious proposal8.7 High- ckeditor ckeditor5Cross-site scripting (XSS) in the real-time collaboration package2.3 Low
- xwiki platform, xwiki, xwiki xwiki-platform +2 moreRemote code execution as guest via SolrSearchMacros request in xwiki9.8 Critical
- rapid response monitoring my security account app apiRapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key8.7 High
- elseta vinci protocol analyzerElseta Vinci Protocol Analyzer OS Command Injection9.4 Critical
- labredescefetrj wegiaSQL Injection endpoint 'html/personalizacao_upload.php' parameter 'id_campo' in WeGIA9.4 Critical
- erlang otpSSH SFTP packet size not verified properly in Erlang OTP7.0 High
- gliffy onlineCSRF in Gliffy5.9 Medium
- cisco openh264OpenH264 Decoding Functions Heap Overflow Vulnerability8.6 High
- ibm security verify accessIBM Security Verify Access Appliance code injection7.8 High
- ping identity pingam java policy agentPingAM Java Policy Agent path traversal9.2 Critical
cloud-regionsrv-clientSUSE,python-tomlSUSE +1 moreSecurity update for cloud-regionsrv-client, python-tomlNo score- wpmaspik lenix leads collectorLenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field7.2 High
- dell recoverpoint for virtual machines, recoverpoint for vms +1 moreDell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low...6.6 Medium
- ibm openpages with watsonIBM OpenPages HTML injection5.4 Medium
- ibm openpages with watsonIBM OpenPages session fixation4.3 Medium
- ibm openpages with watsonIBM OpenPages cross-site request forgery4.3 Medium
- ibm openpages with watsonIBM OpenPages XML external entity injection7.1 High
- dell recoverpoint for vms, recoverpoint for virtual machines +1 moreDell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission...5.5 Medium
- arc53 docsgptRemote Code Execution in DocsGPT9.3 Critical
- awsmin embed any document – embed pdf, word, powerpoint and excel filesEmbed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode6.4 Medium
- mrlegend1235 typed js: a typewriter style animation, typed js +1 moreTyped JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter6.4 Medium
- ex-themes woocommerce food - restaurant menu & food ordering, exthemes woocommerce food +1 moreWooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids7.3 High
- nilambar prime addons for elementorPrime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode4.3 Medium
- bandsintown events, kwestion505 bandsintown events +1 moreBandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- eniture ltl freight quotes, enituretechnology ltl freight quotes – globaltranz edition +1 moreLTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection7.5 High
- legoeso pdf manager, torviswesley legoeso pdf manager +1 moreLegoeso PDF Manager <= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parameter6.5 Medium
- webcodingplace ultimate classified listingsUltimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover8.1 High
- matiskiba ravpageRavpage <= 2.31 - PHP Object Injection9.8 Critical
- webcodingplace ultimate classified listingsUltimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter4.4 Medium
- vanderwijk content blocks (custom post widget), content blocks +1 moreContent Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter6.4 Medium
- dcurasi cookie notice barCookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- codemenschen gift cards (gift vouchers and packages) (woocommerce supported), gift vouchers +1 moreGift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates5.3 Medium
- enituretechnology ltl freight quotes – globaltranz edition, wwexgroup ltl freight quotes +1 moreLTL Freight Quotes – GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- wow-company modal window, wpcalc modal window – create popup modal window +1 moreModal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode6.4 Medium
- xootix login & register customizer – popup | slider | inline | woocommerce, login\/signup popup +1 moreLogin/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode6.4 Medium
- amauri wpmobile.appWPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter7.2 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget6.4 Medium
- i-o data device, inc. ud-lt2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue...7.2 High
- elementor website builder, elemntor elementor website builder – more than just a page builder +1 moreElementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ibm openpages with watsonIBM OpenPages path traversal5.3 Medium
- Show moreLoading…